I've got some browser issues and could use some help. Here's my Hijackthis log!
blokhead
Welcome to
Tom Coyote lets do a few things.
We need to make sure all hidden files are showing : Click Start . Open My Computer . Select the Tools menu and click Folder Options . Select the View tab. Under the Hidden files and folders heading select Show hidden files and folders . Uncheck the Hide file extensions for known types option.Uncheck the Hide protected operating system files (recommended) option.Click Yes to confirm. Click OK . Once your system is clean, we suggest that you reverse this to keep critical windows files from accidently being deleted.
Download and install the 30 day trial of
AVG Anti-Spyware 7.5 to your desktop.
Once you have downloaded AVG Anti-Spyware 7.5 , locate the icon on the desktop and double-click it to launch the set up program. Once the setup is complete you will need run Ewido and update the definition files. On the main screen select the icon Update then select the Update now link. Next select the Start Update button, the update will start and a progress bar will show the updates being installed. Once the update has completed select the Scanner icon at the top of the screen, then select the Settings tab. Once in the Settings screen click on Recommended actions and then select Quarantine <– Dont forget this Under Reports Select Automatically generate report after every scan Un-Select Only if threats were found Close AVG Anti-Spyware 7.5 <– Do not run the scan yet.
Open
HJT Scan Only , close your browser and all open windows, check these and click on
Fix Checked
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
Boot your computer into Safemode Go to Start> Shut Off your Computer> Restart As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly. This will bring up a menu. Use the Up and Down Arrow Keys to scroll up to SAFEMODE Then press the Enter on your Keyboard Tutorial if you need it
How to boot into Safemode
IMPORTANT: Do not open any other windows or programs while ewido is scanning, it may interfere with the scanning process:
Launch AVG Anti-Spyware 7.5 by double-clicking the icon on your desktop. Select the Scanner icon at the top and then the Scan tab then click on Complete System Scan . Ewido will now begin the scanning process, be patient this may take a little time. Once the scan is complete do the following: If you have any infections you will prompted, then select Apply all actions Next select the Reports icon at the top. Select the Save report as button in the lower left hand of the screen and save it to a text file on your system make sure to remember where you saved that file, this is important Close AVG Anti-Spyware 7.5
C:\WINDOWS\System32\
liartth.dll
C:\WINDOWS\System32\
tgrxxnj.dll
Reboot and run this system cleaner
Please download
ATF Cleaner by Atribune.
This program is for XP and Windows 2000 only Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. Your system may start up slower after running ATF Cleaner, this is expected but will be back to normal after the first or second boot up
I need to see the log from AVG and a new HJT log please.
Thanks for the help here are both of the logs you requested!
blokhead
Your HJT log looks good
, but lets do a couple of things. You have a ton of bad files backed up in the windows System Restore program, and if you ever use it to revert your system to an earlier date, you can reinfect yourself all over again. So what we need to do is to flush out all the old restore points and its extremily important that you create a new Restore Point. You also had some bad files in your Temporary Internet Files, so do this.
* Clean out your
Temp Files
* This procedure should be run from
Safemode for better results.
Boot into Safemode
* Go to
Start> Shut off your Computer> Restart
* As the computer starts to boot-up, Tap the
F8 KEY somewhat rapidly, this will bring up a menu.
* Use the
Up and Down Arrow Keys to scroll up to
Safemode
* Then press the
Enter Key on your Keyboard
* Go to
My Computer/ C: Drive/ Documents and Settings/ Every User on this Computer Local Settings and delete all the contents of the
Temp Folder and the
Temporary Internet Files Folder <–Just the contents, not the folder itself.
* Go to
My Computer/ C:/ Windows/ Temp and delete all the contents of the
Temp Folder <– But not the temp folder itself.
* Go to
My Computer/ C:/ Windows/ Prefetch and remove all the contents of the
Prefetch Folder .
<–But not the Prefetch folder itself.
Reboot your system normally
Close any instance of
Internet Explorer and
Windows Explorer. Go to Start> Control Panel> Internet Options . You shoud be on the General Tab Delete Cookies Delete Files > and offline content as well Now Empty your Recycle Bin
System Restore makes regular backups of all your settings, if you ever had to use this program to restore your
system to a previous date, you will be infected all over again so we need to clean out the previous Restore Points
Turn off System Restore.
Right-click My Computer. Click Properties. Click the System Restore tab. Check Turn off System Restore on all Drives. Click Apply , and then click OK. Reboot your System
Turn ON System Restore.
Right-click My Computer. ClickProperties. Click the System Restore tab. UN-Check Turn off System Restore on all Drives. Click Apply, and then click OK. Go to Start/ Control Panel/ Performance and Maintenance/ System Restore/ Create a New Restore Point You can name the restore point anything you like, something that you can remember, You will have to be in Catagory View to see this
AVG had mention of a Purity Infection, lets make sure its gone, run this quick tool and post the report please along with a new HJT log.
Please download
ComboFix by
sUBs from either of these two locations
BleepingComputerComboFix TechSupportForumComboFix Double click combofix.exe & follow the prompts. When finished, it shall produce a log for you. Post that log in your next reply along with a new HJT log please. Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
Here's my current logs!
blokhead
Your log looks fine but Combofix picked up a couple of bad files. This is what I would like you to do.
Download
Pocket Killbox to your desktop, unzip it to a folder that you can find
C:\WINDOWS\uninstDsk.exe
Highlight all the files with the complete path inside the quote and press
Ctrl C on your keyboard.
Open Pocket Killbox Go to File > Paste from clipboard Set it to Delete on Reboot Tick the box that says End Explorer shell while killing file If its not greyed out..Click the radio button that say Unregister .dll before deleting. Make sure ALL Files is selected Click on the Red circle with the white X It will ask you to confirm the deletion…Say yes It will ask you to reboot, say yes
Run this free online virus scanner from
Panda , it may pick up some bad entires that are not showing up on your HJT log. It's important that I see the log so copy and paste it into your next reply.
Panda ActiveScan <—-Accept default settings
Open
HJT > Misc Tools >Uninstall Manager and click on Save List and post the list into this thread.
, but lets do a couple of things. You have a ton of bad files backed up in the windows System Restore program, and if you ever use it to revert your system to an earlier date, you can reinfect yourself all over again. So what we need to do is to flush out all the old restore points and its extremily important that you create a new Restore Point. You also had some bad files in your Temporary Internet Files, so do this.